> This page is for Data Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# AWS: Customize Restore Server Configuration

This article explains how to customize restore server connectivity for AWS restore accounts.

## Customize restore server connectivity

Use this procedure to customize which VPC resources the restore server uses.
For connectivity requirements and information about when customization is needed, see [AWS: Restore Server Requirements].

For this procedure, go to

AWS restore accounts

.

[AWS: Restore Server Requirements]: /data-protection/cloud-workloads/aws/restore-accounts/aws-restore-server-requirements

#### Before you start

Make sure you've reviewed [AWS: Restore Server Requirements] and your restore account's VPC meets the connectivity requirements.

#### Open the wizard

Expand the restore account whose network configuration you want to edit, find **Account configuration > Restore server connectivity**, and select **   > Edit**.
The account's **Edit restore server connectivity** wizard opens.

#### Customize a VPC

By default, Eon automatically chooses the subnet and security group for the restore server.
You can override this behavior by specifying the subnets and security groups you want the restore server to use.

To customize a VPC:

1. Click **Customize VPC** to open the selection dialog.

2. Select the **Region** and **VPC** you want to customize.

3. Click **Customize VPC**.

4. Customize the **Subnets per availability zone** and **Security groups** settings as described in the next steps.

#### Set subnets per availability zone

To override subnets in an availability zone:

1. In **Subnets per availability zone**, choose the availability zone you want to specify a subnet for, and turn **Customize** on.

2. Choose the subnet you want Eon to use.
   Make sure the subnet is configured in a way that meets the restore server's [connectivity requirements][AWS: Restore Server Requirements].

   If the list is empty, you'll need to turn **Customize** off before you can save the settings.

3. Repeat the process for each availability zone you want to customize.

4. If any of the subnets you specified are isolated or private with internet access, turn **Allow restore to private subnets** on.
   The signals to Eon to enable S3 Multi-Region Access Points on your vaults to route cross-region restore traffic privately through the VPC.
   If all subnets are public, leave this off.

For availability zones you customized, future restore servers will now use the specified settings.
Eon won't use any other subnets in the customized availability zones.

For availability zones you didn't customize, Eon will continue to automatically choose the most appropriate subnet for the restore server.

#### Set custom security groups

By default, Eon associates the restore server with the destination region's default security group.
Additionally, when restoring databases, by default, AWS associates the new database with the default security group.

You can override one or both of these settings by specifying a security group for Eon to use during restore:

1. In **Security groups**, choose whether to override the security group for the **Restore server** or the **Restored RDS instance**, and turn **Customize** on.

2. Choose the security group you want Eon to use.
   Make sure the security group is configured in a way that meets the restore server's [connectivity requirements][AWS: Restore Server Requirements].

   If the list is empty, you'll need to turn **Customize** off before you can save the VPC settings.

For the items you customized, these behaviors apply:

* **Restore server**:
  During the restore, Eon associates the restore server with the specified security group.

* **Restored RDS instances**:
  During the restore, Eon associates the restored instance with the specified security group.
  After the restore, the specified security group is disassociated from the instance.

  > **Info**
  >
  > The security groups specified at the time you [restore an RDS instance] aren't the same as the security groups you set in this procedure, as described here.
  >
  > **Security groups specified at restore time** \
  >
  > The associations between the security groups and the restored RDS instance are persistent.
  > In other words, the association remains in place after the restore is complete.
  >
  > **Security groups specified in a VPC customization** \
  >
  > The association between the security group and the restored RDS instance is temporary.
  > Its purpose is to allow the restore server to populate the RDS instance with restored data.
  > The temporary association is removed after the restore is complete.

  [restore an RDS instance]: /data-protection/restoring/restore-cloud-workloads/aws/rds-and-aurora/rds-restore-an-instance#set-the-restored-instance-details

For items you didn't customize, AWS automatically associates the default security group.
For RDS instances, this means the default security group remains associated with the restored instance after the restore is complete.

#### Save the VPC settings

When you're done, save the VPC customizations.

#### Repeat for additional VPCs

You can repeat this process for each VPC you want to customize.

To revert a VPC to the default settings, select ** (Actions) > Delete** for the VPC.

When you've set all the intended VPCs to the settings you want, save your changes.

You're returned to the **Restore Accounts** page, and the restore account indicates it uses **Custom** restore server connectivity settings.

## See also

* [AWS: Restore Server Requirements]
* [AWS: Connect Restore Accounts]
* [About Restore Accounts]

[AWS: Connect Restore Accounts]: /data-protection/cloud-workloads/aws/restore-accounts/aws-connect-restore-accounts

[About Restore Accounts]: /data-protection/restoring/restore-accounts/about-restore-accounts